CVE-2026-84668

The Jenkins SAML Plugin versions 4.618.v441a_27fa_46d2 and earlier are vulnerable to an attack that enables the overwriting of the SAML identity provider metadata file via Stapler data binding. This flaw allows attackers to substitute the metadata with malicious content, potentially enabling them to authenticate as any user within the Jenkins environment. Organizations using this plugin should prioritize remediation to mitigate the risk of unauthorized access.